diff --git a/decisions/2026-09-30-jackett-oauth2-proxy-session.md b/decisions/2026-09-30-jackett-oauth2-proxy-session.md
index 0bf3dc8..d8c0259 100644
--- a/decisions/2026-09-30-jackett-oauth2-proxy-session.md
+++ b/decisions/2026-09-30-jackett-oauth2-proxy-session.md
@@ -200,6 +200,18 @@ than the file merely existing.
   not skipped — mounting the sibling spec repo at `/home-network-k3s` (the path
   `ci/spec-immutability.sh` actually defaults to) in the ENGINE shim fixes that skip; the commonly
   circulated shim mounts it at its host path, where `SPEC_REPO` never finds it.
+- **Gitea CI on this PR, read from the commit's `/statuses` rather than from a tick.** Two contexts
+  reported, and **only one of them ran**:
+
+      gate / gate (pull_request)         state=success   desc='Successful in 1m41s'
+      gate / conformance (pull_request)  state=success   desc='Has been skipped'
+
+  That second line is §2b's trap in the wild: a **skipped** Gitea job reports `state=success`. The
+  conformance job did not execute, so the green tick beside it certifies nothing. Read together with
+  the local rc 3 above, the two agree exactly — the offline L0/L1 subset passed and L2/L3 never ran.
+  Anyone reading the PR's check mark alone would conclude otherwise.
+- **`main` is protected**, re-measured this session rather than assumed:
+  `GET /repos/.../branches/main` → `protected=true`, `user_can_push=false`.
 
 ## What I did NOT verify